---
title: "Make password resets safe · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/password-reset
updated: 2026-10-20
licence: "All rights reserved"
---

# Make password resets safe

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts)
- Rule: Make a password reset as strong as login. Build the link from your own address, and end every other session after a reset.
- How: Make the link itself as the [sign-in links rule](https://agentwranglers.se/playbook/email/email-security/sign-in-links) says. Answer the same way whether or not the account exists, as [no account enumeration](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/no-account-enumeration) explains. Never build the link from the request's `Host` header. A reset must still ask for the second factor, or use a recovery code.
- Check: Send a reset request with `Host: attacker.example.org`. The email still links to your own domain. After the reset, other sessions are logged out. On an account with two-factor login, the reset still asks for the second factor.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/password-reset`.

- Previous: [Block cross-site form posts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/cross-site-requests)
- Next: [Accept only the fields you expect](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/mass-assignment)
- [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts)